diff --git a/global/profiles/genesis.yaml b/global/profiles/genesis.yaml
index 9a33650c0..073a5aade 100644
--- a/global/profiles/genesis.yaml
+++ b/global/profiles/genesis.yaml
@@ -41,6 +41,12 @@ metadata:
         path: .images.kubernetes.etcd.etcd
       dest:
         path: .images.kubernetes.etcd
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.kubernetes.etcd.etcdctl
+      dest:
+        path: .images.kubernetes.etcdctl
     - src:
         schema: pegleg/SoftwareVersions/v1
         name: software-versions
diff --git a/global/schemas/promenade/Genesis/v1.yaml b/global/schemas/promenade/Genesis/v1.yaml
index 95b50c3f8..6a32c0875 100644
--- a/global/schemas/promenade/Genesis/v1.yaml
+++ b/global/schemas/promenade/Genesis/v1.yaml
@@ -142,12 +142,15 @@ data:
               $ref: '#/definitions/image'
             etcd:
               $ref: '#/definitions/image'
+            etcdctl:
+              $ref: '#/definitions/image'
             scheduler:
               $ref: '#/definitions/image'
           required:
             - apiserver
             - controller-manager
             - etcd
+            - etcdctl
             - scheduler
           additionalProperties: false
       required:
diff --git a/global/software/charts/kubernetes/core/apiserver.yaml b/global/software/charts/kubernetes/core/apiserver.yaml
index eb9d5285b..41344021a 100644
--- a/global/software/charts/kubernetes/core/apiserver.yaml
+++ b/global/software/charts/kubernetes/core/apiserver.yaml
@@ -163,7 +163,7 @@ data:
       acconfig:
         file: acconfig.yaml
         command_options:
-          - '--enable-admission-plugins=PodSecurityPolicy,NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds,NodeRestriction,EventRateLimit'
+          - '--enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds,NodeRestriction,EventRateLimit'
           - '--admission-control-config-file=/etc/kubernetes/apiserver/acconfig.yaml'
         content:
           kind: AdmissionConfiguration
diff --git a/global/software/config/versions.yaml b/global/software/config/versions.yaml
index e5a24f2a7..1299e27c2 100644
--- a/global/software/config/versions.yaml
+++ b/global/software/config/versions.yaml
@@ -421,14 +421,14 @@ data:
       calico:
         calico_cni: quay.io/calico/cni:v3.4.0
         calico_ctl: docker.io/calico/ctl:v3.4.0
-        calico_etcd: quay.io/coreos/etcd:v3.4.2
+        calico_etcd: quay.io/coreos/etcd:v3.5.11
         calico_kube_controllers: quay.io/calico/kube-controllers:v3.4.0
         calico_node: quay.io/calico/node:v3.4.0
         calico_settings: docker.io/calico/ctl:v3.4.0
         dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
       etcd:
-        etcd: quay.io/coreos/etcd:v3.4.2
-        etcdctl: quay.io/coreos/etcd:v3.4.2
+        etcd: quay.io/coreos/etcd:v3.5.11
+        etcdctl: "quay.io/airshipit/porthole-etcdctl-utility:latest-ubuntu_focal"
     ceph:
       ceph-client:
         ceph_bootstrap: docker.io/openstackhelm/ceph-daemon:ubuntu_xenial-20191119
@@ -511,8 +511,8 @@ data:
         coredns: coredns/coredns:1.9.4
         test: quay.io/airshipit/promenade:latest
       etcd:
-        etcd: quay.io/coreos/etcd:v3.4.2
-        etcdctl: quay.io/coreos/etcd:v3.4.2
+        etcd: quay.io/coreos/etcd:v3.5.11
+        etcdctl: "quay.io/airshipit/porthole-etcdctl-utility:latest-ubuntu_focal"
       haproxy:
         anchor: gcr.io/google-containers/hyperkube-amd64:v1.17.3
         haproxy: docker.io/library/haproxy:1.8.19